Key Takeaways
- The hack used a price manipulation attack to trick Rari Capital’s smart contract into misjudging the price of Alpha’s ibETH token.
- The team has been working with other Ethereum developers to fix the vulnerabilities and has been actively answering community questions.
- During a community call, Rari’s team announced they were foregoing their token allocation to reimburse users who lost funds in this attack.
Following the $11 million hack over the weekend, Rari’s native token crashed from $18 to $10. The team behind the protocol has, however, moved quickly to make victims whole.
Rari Suffers Weekend Hack, Drops $11M
Rari Capital is a DeFi protocol building optimized yield vaults and offering lending and borrowing on niche tokens. Recently, the team integrated Alpha Finance’s ibETH token, which is an interest-bearing Ethereum token. On May 8, the smart contract in charge of depositing ETH in Alpha Finance’s ibETH pool was hacked.
While the exploit threatened no Alpha funds, liquidity providers (LPs) from the Rari ETH pool lost a combined 2,600 ETH, totaling over $10 million. The hackers artificially inflated the value of the ETH pool on Rari by using a flash loan from dYdX. They then withdrew ETH from the pool using a function that the hackers should not have had access to.
This technique is called an indirect price manipulation attack. It relies on the attacker manipulating the token price using a flash loan to inflate its price during a few brief moments artificially. As the price of the token on the Rari ETH pool is linked to the value of the ibETH held by the protocol, manipulating the price of ibETH influences Rari’s ETH pool token as well.
While Alpha Finance can’t be blamed for the exploit, if they had reviewed the security of Rari’s integration, they could have spotted the vulnerability. The hackers left a message in a pending transaction claiming that Alpha’s quick reaction saved up to $6 million worth of users’ funds at the time of the hack. No funds on Alpha were stolen.
https://twitter.com/bantg/status/1391054251388964867
Alpha Finance were themselves victims of a similar exploit when hackers found a vulnerability in their integration of CREAM’s Iron Bank. The attackers had then taken over $37.5 million worth of funds using a similar flash loan-based price manipulation tactic. The account linked to the hack was also responsible for the recent attack on the BSC project Value DeFi.
The team has gone beyond fixing the above-mentioned bugs too. All of the protocol contributors decided to forego their token allocation in RGT to reimburse anyone affected by the hack. The 2,000,000 RGT (currently worth over $20 million) have been sent to the DAO in charge of both reimbursing lost funds and rewarding those who helped Rari fight the attack.
Disclaimer: The author held BTC, ETH, and several other cryptocurrencies at the time of writing.
